atom-agent 0.3.0 → 1.1.0

package/dist/tools/search.js

@@ -0,0 +1,242 @@
+// Search executors: grep (content regex) and glob (path patterns).
+// Read-only over the repo; node_modules/.git skipped by the walker.
+import { promises as fsp } from "node:fs";
+import * as path from "node:path";
+import { listFiles } from "./dir-cache.js";
+import { err, GLOB_MATCH_CAP, GREP_MATCH_CAP, invalidCall, resolveSandbox } from "./shared.js";
+// Minimal glob matcher: supports **, **/, *, ?. Used for grep `include`
+// and the glob tool. Patterns without a slash match the basename.
+function globToRegExp(glob) {
+    let re = "";
+    let i = 0;
+    while (i < glob.length) {
+        const c = glob[i];
+        if (c === "*") {
+            if (glob[i + 1] === "*") {
+                // "**/" matches zero or more directories; bare "**" matches all.
+                if (glob[i + 2] === "/") {
+                    re += "(?:.*/)?";
+                    i += 3;
+                }
+                else {
+                    re += ".*";
+                    i += 2;
+                }
+            }
+            else {
+                re += "[^/]*";
+                i += 1;
+            }
+        }
+        else if (c === "?") {
+            re += "[^/]";
+            i += 1;
+        }
+        else {
+            re += c.replace(/[.+^${}()|[\]\\]/, "\\$&");
+            i += 1;
+        }
+    }
+    return new RegExp(`^${re}$`);
+}
+function matchesGlob(pattern, relPosix) {
+    const norm = pattern.replace(/\\/g, "/");
+    if (!norm.includes("/")) {
+        const base = relPosix.slice(relPosix.lastIndexOf("/") + 1);
+        return globToRegExp(norm).test(base);
+    }
+    return globToRegExp(norm).test(relPosix);
+}
+export const GREP_OUTPUT_MODES = new Set([
+    "content",
+    "files_with_matches",
+    "count",
+]);
+// File-read fan-out for scans: bounded parallelism (32 in flight) over an
+// ordered list, results in input order. Disk I/O overlaps instead of
+// serializing one open/read/close at a time; the regex pass stays sequential
+// afterwards so outputs and first-failure errors keep exact alpha order.
+// 32 concurrent opens is far below EMFILE on every supported platform.
+const SCAN_CONCURRENCY = 32;
+async function mapLimit(items, limit, fn) {
+    const out = new Array(items.length);
+    let next = 0;
+    const workers = new Array(Math.min(Math.max(limit, 1), Math.max(items.length, 1)))
+        .fill(0)
+        .map(async () => {
+        for (;;) {
+            const i = next++;
+            if (i >= items.length)
+                return;
+            out[i] = await fn(items[i], i);
+        }
+    });
+    await Promise.all(workers);
+    return out;
+}
+// Best-effort mtime (ms) for recency sorting; 0 when the file cannot be
+// stat'ed (keeps such entries last instead of failing the search).
+async function mtimeMs(abs) {
+    try {
+        return (await fsp.stat(abs)).mtimeMs;
+    }
+    catch {
+        return 0;
+    }
+}
+// Line-regex search under dir (default "."). `include` is a glob like
+// "*.ts". `outputMode` selects the shape (Claude-Code-style):
+// - "content" (default): "file:line: text" lines, capped at 100 matches.
+// - "files_with_matches": matching file paths newest-first with a
+//   "Found N file(s)" header, capped at 100 listed files.
+// - "count": per-file "file:count" lines plus a totals line; the totals
+//   cover every match even when the listed files are capped.
+export async function grepTool(args, cwd = process.cwd()) {
+    try {
+        if (typeof args?.pattern !== "string")
+            return err("pattern must be a string");
+        let re;
+        try {
+            re = new RegExp(args.pattern);
+        }
+        catch {
+            return err(`invalid regex: ${args.pattern}`);
+        }
+        const mode = args?.outputMode ?? "content";
+        if (!GREP_OUTPUT_MODES.has(mode)) {
+            return invalidCall(`field "outputMode" for tool "grep" must be one of "content", "files_with_matches", "count" (got ${JSON.stringify(args?.outputMode)})`);
+        }
+        const dir = args.dir ?? ".";
+        const r = resolveSandbox(dir, cwd);
+        if (r.error || !r.abs)
+            return r.error ?? err("bad dir");
+        let st;
+        try {
+            st = await fsp.stat(r.abs);
+        }
+        catch {
+            return err(`no such directory: ${dir}`);
+        }
+        if (!st.isDirectory())
+            return err(`not a directory: ${dir}`);
+        const files = await listFiles(r.abs, cwd);
+        const include = typeof args.include === "string" && args.include.length > 0 ? args.include : null;
+        // Single scan for all modes: ONE read per file (the old code read every
+        // file twice — counts pass, then content pass). Counts are matching LINES
+        // per file (ripgrep --count semantics); content hits accumulate inline in
+        // the same alpha order the two-pass scan produced, so outputs are
+        // byte-identical with half the I/O.
+        const collectHits = mode === "content";
+        const sorted = files.sort();
+        // Bulk read (bounded parallelism), then regex sequentially: I/O overlaps
+        // while outputs and first-failure errors keep exact alpha order.
+        const bodies = await mapLimit(sorted, SCAN_CONCURRENCY, async (rel) => {
+            if (include && !matchesGlob(include, rel))
+                return null;
+            try {
+                const text = await fsp.readFile(path.resolve(cwd, rel), "utf8");
+                if (text.includes("\0"))
+                    return null; // binary — skip
+                return { rel, text };
+            }
+            catch {
+                return null; // unreadable — skip
+            }
+        });
+        const counts = [];
+        const hits = [];
+        let hitsCapped = false;
+        for (const body of bodies) {
+            if (body === null)
+                continue;
+            if (collectHits && hitsCapped)
+                break;
+            const { rel, text } = body;
+            const lines = text.split("\n");
+            let n = 0;
+            for (let i = 0; i < lines.length; i++) {
+                let matched;
+                try {
+                    matched = re.test(lines[i]);
+                }
+                catch {
+                    return err(`regex failed on input: ${args.pattern}`);
+                }
+                // Reset lastIndex in case the pattern is global/sticky.
+                re.lastIndex = 0;
+                if (!matched)
+                    continue;
+                n += 1;
+                if (collectHits && !hitsCapped) {
+                    const line = lines[i];
+                    hits.push(`${rel}:${i + 1}: ${line.length > 200 ? line.slice(0, 200) + "…" : line}`);
+                    if (hits.length >= GREP_MATCH_CAP)
+                        hitsCapped = true;
+                }
+            }
+            if (n > 0)
+                counts.push({ rel, n });
+        }
+        if (counts.length === 0)
+            return "No matches.";
+        if (mode === "files_with_matches") {
+            const withTime = await Promise.all(counts.map(async (c) => ({ rel: c.rel, t: await mtimeMs(path.resolve(cwd, c.rel)) })));
+            withTime.sort((a, b) => b.t - a.t || (a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0));
+            const listed = withTime.slice(0, GREP_MATCH_CAP).map((c) => c.rel);
+            let out = `Found ${withTime.length} file(s)\n${listed.join("\n")}`;
+            if (withTime.length > GREP_MATCH_CAP)
+                out += "\n[truncated: more than 100 matching files]";
+            return out;
+        }
+        if (mode === "count") {
+            const listed = counts.slice(0, GREP_MATCH_CAP);
+            const total = counts.reduce((s, c) => s + c.n, 0);
+            let out = listed.map((c) => `${c.rel}:${c.n}`).join("\n") +
+                `\nFound ${total} total match(es) across ${counts.length} file(s).`;
+            if (counts.length > GREP_MATCH_CAP)
+                out += "\n[truncated: more than 100 matching files]";
+            return out;
+        }
+        // Content hits accumulated inline above (same order, same cap).
+        if (hitsCapped)
+            return hits.join("\n") + "\n[truncated: more than 100 matches]";
+        return hits.length > 0 ? hits.join("\n") : "No matches.";
+    }
+    catch (e) {
+        return err(e instanceof Error ? e.message : String(e));
+    }
+}
+// List paths matching pattern under dir, newest-first by modification
+// time (opencode/Claude parity: recency ≈ relevance), capped at 200.
+export async function globTool(args, cwd = process.cwd()) {
+    try {
+        if (typeof args?.pattern !== "string" || args.pattern.length === 0) {
+            return err("pattern must be a non-empty string");
+        }
+        const dir = args.dir ?? ".";
+        const r = resolveSandbox(dir, cwd);
+        if (r.error || !r.abs)
+            return r.error ?? err("bad dir");
+        let st;
+        try {
+            st = await fsp.stat(r.abs);
+        }
+        catch {
+            return err(`no such directory: ${dir}`);
+        }
+        if (!st.isDirectory())
+            return err(`not a directory: ${dir}`);
+        const files = await listFiles(r.abs, cwd);
+        const matched = files.filter((rel) => matchesGlob(args.pattern, rel));
+        const withTime = await Promise.all(matched.map(async (rel) => ({ rel, t: await mtimeMs(path.resolve(cwd, rel)) })));
+        withTime.sort((a, b) => b.t - a.t || (a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0));
+        const capped = withTime.slice(0, GLOB_MATCH_CAP).map((e) => e.rel);
+        let out = capped.length > 0 ? capped.join("\n") : "No matches.";
+        if (withTime.length > GLOB_MATCH_CAP)
+            out += "\n[truncated: more than 200 matches]";
+        return out;
+    }
+    catch (e) {
+        return err(e instanceof Error ? e.message : String(e));
+    }
+}

package/dist/tools/shared.js

@@ -0,0 +1,31 @@
+// Tool kernel: byte/path caps, error formatters, and sandbox-free path
+// resolution shared by every executor. No executor state, no side effects.
+import * as path from "node:path";
+export const READ_CHAR_CAP = 64 * 1024;
+export const OUTPUT_CAP = 8 * 1024;
+export const GREP_MATCH_CAP = 100;
+export const GLOB_MATCH_CAP = 200;
+export const SKIP_DIRS = new Set(["node_modules", ".git"]);
+export function err(msg) {
+    return `Error: ${msg}`;
+}
+// Model-mistake framing helper: `Error: invalid call: <detail> Fix the
+// arguments and retry.` — the tool never ran. Tool-runtime failures keep
+// plain `Error: <detail>`.
+export function invalidCall(detail) {
+    const d = detail.endsWith(".") ? detail : `${detail}.`;
+    return `Error: invalid call: ${d} Fix the arguments and retry.`;
+}
+// Resolve a user-supplied path: relative paths resolve against cwd, and
+// absolute paths (plus `..` escapes) are allowed anywhere on the computer
+// (Claude-Code-style permissions model — the mode system, not a path
+// sandbox, is the control plane). Only empty/non-string paths and null
+// bytes are rejected.
+export function resolveSandbox(p, cwd = process.cwd()) {
+    if (typeof p !== "string" || p.length === 0) {
+        return { error: "Error: path must be a non-empty string" };
+    }
+    if (p.includes("\0"))
+        return { error: "Error: invalid path" };
+    return { abs: path.resolve(cwd, p) };
+}

package/dist/tools/shell.js

@@ -0,0 +1,273 @@
+// Shell executors: foreground bash and detached background tasks.
+// No sandbox beyond cwd+timeout — the approval layer owns the privilege
+// decision. Shell output passes through secret scrubbing (see policy.ts).
+import { exec, spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import * as fs from "node:fs";
+import { promises as fsp } from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { scrubSecrets } from "../policy.js";
+import { PROVIDERS } from "../providers.js";
+import { clearDirListingCache } from "./dir-cache.js";
+import { appendOverflow } from "./overflow.js";
+import { err, OUTPUT_CAP } from "./shared.js";
+// ---- Background bash tasks (Claude-Code-style run_in_background) ----
+const BG_TASK_CAP = 20;
+const BG_POLL_MS = 100;
+// Insertion-ordered: the first key is the oldest task (Map preserves
+// insertion order). Finished tasks stay readable until pruned.
+const bgTasks = new Map();
+let bgCounter = 0;
+function bgDir() {
+    return path.join(os.tmpdir(), "atom-tasks");
+}
+function newBgId() {
+    for (;;) {
+        bgCounter += 1;
+        const id = `${Date.now().toString(36)}${bgCounter.toString(36)}${randomBytes(3).toString("hex")}`;
+        if (!bgTasks.has(id))
+            return id;
+    }
+}
+// Keep the last ~20 task records in memory; prune older temp files
+// best-effort (a still-running task's files may be recreated by later
+// output — its append guard below stops that once pruned).
+function pruneBgTasks() {
+    while (bgTasks.size > BG_TASK_CAP) {
+        const oldest = bgTasks.keys().next();
+        if (oldest.done)
+            return;
+        const key = oldest.value;
+        const rec = bgTasks.get(key);
+        bgTasks.delete(key);
+        if (rec) {
+            for (const f of [rec.stdoutFile, rec.stderrFile]) {
+                try {
+                    fs.rmSync(f, { force: true });
+                }
+                catch {
+                    // best-effort
+                }
+            }
+        }
+    }
+}
+// Spawn in the background (unref'd, stdin ignored, stdout/stderr piped
+// and appended to temp files) and return IMMEDIATELY. The process runs
+// independent of the loop; poll it with bash_output.
+// Windows note: `detached: true` drops child output on Windows (verified:
+// detached cmd.exe children exit 0 with empty captures, for both fd and
+// pipe stdio), so Windows spawns attached — still unref'd with stdin
+// ignored, so the observable contract (immediate return, independent run,
+// output to temp files) is unchanged. POSIX keeps detached:true so
+// background tasks are shielded from Ctrl+C in a new process group.
+// Chunks are appended synchronously so that once `close` marks the task
+// finished, every byte is already on disk for bash_output — no flush race.
+async function startBackgroundBash(command, cwd) {
+    try {
+        const dir = bgDir();
+        await fsp.mkdir(dir, { recursive: true });
+        const id = newBgId();
+        const stdoutFile = path.join(dir, `${id}.stdout.log`);
+        const stderrFile = path.join(dir, `${id}.stderr.log`);
+        await fsp.writeFile(stdoutFile, "", "utf8");
+        await fsp.writeFile(stderrFile, "", "utf8");
+        const rec = {
+            id,
+            stdoutFile,
+            stderrFile,
+            running: true,
+            exitCode: null,
+        };
+        let child;
+        try {
+            child = spawn(command, {
+                cwd,
+                shell: true,
+                detached: process.platform !== "win32",
+                stdio: ["ignore", "pipe", "pipe"],
+                windowsHide: true,
+            });
+        }
+        catch (e) {
+            return err(e instanceof Error ? e.message : String(e));
+        }
+        bgTasks.set(id, rec);
+        pruneBgTasks();
+        const append = (file, chunk) => {
+            // A pruned (evicted) task is unpollable: stop growing its files.
+            if (bgTasks.get(id) !== rec)
+                return;
+            try {
+                fs.appendFileSync(file, chunk);
+            }
+            catch {
+                // best-effort: a failed append must never break the task
+            }
+        };
+        child.stdout?.on("data", (d) => append(stdoutFile, d));
+        child.stderr?.on("data", (d) => append(stderrFile, d));
+        child.on("error", () => {
+            rec.running = false;
+            if (rec.exitCode === null)
+                rec.exitCode = 1;
+            // `close` may still follow; it overwrites with the real code.
+        });
+        // `close` (not `exit`): all piped output has been received, and the
+        // synchronous appends above mean it is already on disk.
+        child.on("close", (code) => {
+            rec.running = false;
+            rec.exitCode = typeof code === "number" ? code : 1;
+        });
+        child.unref();
+        // A spawned command can touch anything (files, trees, checkouts): the
+        // directory-listing cache cannot know what changed, so drop it all. Cheap
+        // (next search rescans once) and exactly correct for tool-driven flows;
+        // only out-of-process edits stay TTL-bound.
+        try {
+            clearDirListingCache();
+        }
+        catch {
+            // never break the tool
+        }
+        return JSON.stringify({ backgroundTaskId: id, status: "running", hint: "use bash_output to poll" });
+    }
+    catch (e) {
+        return err(e instanceof Error ? e.message : String(e));
+    }
+}
+function sleepMs(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+// Known provider secrets (live env values) for shell-output scrubbing. Shell
+// inherits our environment, so `env`/`printenv` — or an echoed pasted key —
+// would otherwise hand secrets to the model and into saved transcripts.
+// Exported for tests. Stored keys (~/.atom/auth.json) are NOT covered, only
+// env-provided values; short values are skipped by scrubSecrets itself.
+export function providerSecrets() {
+    const out = [];
+    for (const p of PROVIDERS) {
+        for (const name of p.envVars) {
+            const v = process.env[name];
+            if (typeof v === "string" && v.length > 0)
+                out.push(v);
+        }
+    }
+    return out;
+}
+function capBgStream(s, which) {
+    // Presentation-layer scrub: background output files on disk keep raw bytes
+    // (chunked appends cannot redact safely); everything the model sees via
+    // bash_output passes through here.
+    const clean = scrubSecrets(s, providerSecrets());
+    if (clean.length > OUTPUT_CAP) {
+        const full = clean;
+        return appendOverflow(full.slice(0, OUTPUT_CAP), `\n[truncated: ${which} exceeded 8KB]`, `background ${which}`, full);
+    }
+    return clean;
+}
+// Poll a background task. When running and timeoutMs > 0, waits (polling
+// the output files about every 100ms) until exit or the wait expires.
+// Error strings, never throws.
+export async function bashOutputTool(args) {
+    try {
+        const taskId = typeof args?.taskId === "string" ? args.taskId : "";
+        const rec = bgTasks.get(taskId);
+        if (!rec)
+            return err("unknown background task");
+        const t = args?.timeoutMs;
+        const timeoutMs = typeof t === "number" && Number.isFinite(t) ? Math.min(Math.max(Math.floor(t), 0), 60000) : 5000;
+        const start = Date.now();
+        while (rec.running && Date.now() - start < timeoutMs) {
+            await sleepMs(Math.min(BG_POLL_MS, Math.max(timeoutMs - (Date.now() - start), 1)));
+        }
+        let stdout = "";
+        let stderr = "";
+        try {
+            stdout = await fsp.readFile(rec.stdoutFile, "utf8");
+        }
+        catch {
+            stdout = "";
+        }
+        try {
+            stderr = await fsp.readFile(rec.stderrFile, "utf8");
+        }
+        catch {
+            stderr = "";
+        }
+        return JSON.stringify({
+            taskId: rec.id,
+            running: rec.running,
+            exitCode: rec.running ? null : rec.exitCode,
+            stdout: capBgStream(stdout, "stdout"),
+            stderr: capBgStream(stderr, "stderr"),
+            timedOut: rec.running && timeoutMs > 0,
+        });
+    }
+    catch (e) {
+        return err(e instanceof Error ? e.message : String(e));
+    }
+}
+// Run in the system shell with cwd=process.cwd() (or the caller's cwd),
+// stdin closed. stdout/stderr each truncated to ~8KB. Returns JSON:
+// {"exitCode": number, "stdout": string, "stderr": string, ...}.
+// No sandbox beyond cwd+timeout+truncation — the model must treat this
+// as a privileged operation.
+export function bashTool(args, cwd = process.cwd()) {
+    if (typeof args?.command !== "string" || args.command.trim().length === 0) {
+        return Promise.resolve(err("command must be a non-empty string"));
+    }
+    if (args.runInBackground === true) {
+        return startBackgroundBash(args.command, cwd);
+    }
+    const timeoutMs = Math.min(Math.max(Math.floor(args.timeoutMs ?? 60000), 1), 120000);
+    return new Promise((resolve) => {
+        exec(args.command, { cwd, timeout: timeoutMs, windowsHide: true, maxBuffer: 16 * 1024 * 1024 }, (error, stdout, stderr) => {
+            // The command ran (whatever its exit): it may have mutated the tree,
+            // so the listing cache is dropped (see background path above).
+            try {
+                clearDirListingCache();
+            }
+            catch {
+                // never break the tool
+            }
+            try {
+                const e = error;
+                const exitCode = e ? (typeof e.code === "number" ? e.code : 1) : 0;
+                let out = typeof stdout === "string" ? stdout : String(stdout ?? "");
+                let errText = typeof stderr === "string" ? stderr : String(stderr ?? "");
+                // Scrub BEFORE truncation/spill: overflow files must never persist raw
+                // secrets to disk either.
+                const secrets = providerSecrets();
+                if (secrets.length > 0) {
+                    out = scrubSecrets(out, secrets);
+                    errText = scrubSecrets(errText, secrets);
+                }
+                let stdoutTruncated = false;
+                let stderrTruncated = false;
+                if (out.length > OUTPUT_CAP) {
+                    const full = out;
+                    out = appendOverflow(full.slice(0, OUTPUT_CAP), "\n[truncated: stdout exceeded 8KB]", "command stdout", full);
+                    stdoutTruncated = true;
+                }
+                if (errText.length > OUTPUT_CAP) {
+                    const full = errText;
+                    errText = appendOverflow(full.slice(0, OUTPUT_CAP), "\n[truncated: stderr exceeded 8KB]", "command stderr", full);
+                    stderrTruncated = true;
+                }
+                resolve(JSON.stringify({
+                    exitCode,
+                    stdout: out,
+                    stderr: errText,
+                    timedOut: e?.killed === true,
+                    stdoutTruncated,
+                    stderrTruncated,
+                }));
+            }
+            catch (ex) {
+                resolve(err(ex instanceof Error ? ex.message : String(ex)));
+            }
+        });
+    });
+}